Trace 72h0p7pe

{"results":[{"id":"ob_1117","label":"active list result 1","score":0.3},{"id":"ob_1258","label":"active list result 2","score":0.57},{"id":"ob_1826","label":"active list result 3","score":0.93}],"padding":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}

{"item":{"id":"ob_1122","status":"updated","time_range":"last_24h","activity_types":["user_creation","user_modification","group_modification","gpo_changes"]}}

{"item":{"id":"ob_1684","status":"active","seats":2}}

{"item":{"id":"ob_1624","status":"updated","attack_types":["kerberoasting","golden_ticket","silver_ticket"],"time_range":"last_24h","include_service_accounts":true}}

{"item":{"id":"ob_1388","status":"updated","time_window_hours":24,"authentication_types":["kerberos","ntlm"],"include_service_accounts":true}}

{"item":{"id":"ob_1468","status":"updated","trust_type":"all","trust_direction":"all","check_sid_filtering":true,"validate_connectivity":true}}

{"item":{"id":"ob_1702","status":"updated","ldap_filter":"(objectClass=user)","time_range":"24h","event_types":["logon","privilege_escalation","group_modification"],"limit":50}}

{"item":{"id":"ob_1361","status":"active","seats":3}}

{"error":{"type":"upstream_5xx","message":"active__analyze_kerberos_tickets failed transiently"}}

{"item":{"id":"ob_1711","status":"updated","time_range":"last_24h","risk_level":"critical","operation_type":"all"}}

{"item":{"id":"ob_1812","status":"updated","time_range":"24h","ticket_type":"all","suspicious_only":true}}

{"item":{"id":"ob_1510","status":"active","seats":4}}

{"item":{"id":"ob_1464","status":"updated","technique":"all","time_range":"24h"}}

{"created":{"id":"ob_1532","title":"Active Directory Security Assessment - Multiple Indicators Detected","severity":"high","category":"privilege_escalation","auto_enrich":true,"affected_users":["ob_1826"],"initial_evidence":"Comprehensive AD security review identified privileged account activity, Kerberos anomalies, and group membership changes requiring investigation"}}

{"results":[{"id":"ob_1225","label":"active list result 1","score":0.67},{"id":"ob_1461","label":"active list result 2","score":0.35}]}

{"item":{"id":"ob_1504","status":"updated","time_range":"last_24h","activity_types":["user_creation","user_modification","group_modification","gpo_changes","schema_changes","trust_changes","delegation_changes"]}}

{"error":{"type":"timeout","message":"active__quarantine_user_account failed transiently"}}

{"item":{"id":"ob_1621","status":"updated","computer_name":"ob_1464","quarantine_level":"network_isolation","incident_id":"ob_1532","duration_hours":48}}

{"item":{"id":"ob_1307","status":"updated","user_id":"ob_1826","reason":"suspected_compromise","disable_account":true,"revoke_sessions":true,"notes":"User identified with high-risk activity during comprehensive AD security assessment - retry after timeout"}}

{"item":{"id":"ob_1383","status":"active","seats":2}}

{"item":{"id":"ob_1236","status":"updated","group_dn":"CN=Domain Admins,CN=Users,DC=domain,DC=com","include_nested_groups":true,"show_effective_rights":true,"permission_scope":"domain"}}

{"item":{"id":"ob_1002","status":"updated","attack_types":["dcsync","asreproasting"],"time_range":"last_24h","include_service_accounts":true}}